Ultimate WooCommerce Auction Pro <=2.4.5 Reflected XSS Vulnerability Advisory

Vulnerability Overview Vulnerability Name: Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via Description: This plugin fails to sanitize and escape parameters before output, leading to a reflected Cross-Site Scripting (XSS) vulnerability, which can be exploited for attacks targeting high-privilege users (e.g., administrators). CVE ID: CVE-2026-4259 Classification: - Type: XSS - OWASP Top 10: A7: Cross-Site Scripting (XSS) - CWE: CWE-79 - CVSS: 7.1 (High) Affected Versions Affected Plugin: ultimate-woocommerce-auction-pro Known Fixes: None Remediation Fix Status: The page indicates "No known fixes"; users are advised to monitor for plugin updates or contact the developer for a patch. Additional Information Original Researcher: Kacper Rybczyński Submitter: Kacper Rybczyński Submitter Website: https://zabkagroup.com/ Verification Status: Verified WPVDB ID: a98d234b-11e8-4a07-8593-982d656a4fd3 Timeline Public Disclosure Date: 2026-06-01 (approximately 25 days ago) Added Date: 2026-06-01 (approximately 25 days ago) Last Updated: 2026-06-01 (approximately 25 days ago) Related Vulnerabilities W4 Post List < 2.4.5 - Contributor+ Stored XSS (2023-03-08) Flexi - Guest Submit < 4.20 - Reflected Cross-Site Scripting (2022-02-16) NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission (2026-06-26) SP Blog Designer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'design' Attribute (2026-05-11) WD Instagram Feed <= 1.3.0 - XSS (2018-04-23) Proof of Concept (POC) POC Code: The page states "POC will be displayed after the issue is fixed"; therefore, no POC code is currently available on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Ultimate WooCommerce Auction Pro <=2.4.5 Reflected XSS Vulnerability Advisory